Accidental assignment within if statement:
This happens all to often, I just found one today in some code I’m fixing.
The error looks like this:
if($_REQUEST['action'] = 'delete'){ // run the delete code...
Of course, delete will run every time. This should be:
if($_REQUEST['action'] == 'delete'){ // run the delete code..
An even better practice to get into is swapping the variables around:
if('delete' == $_REQUEST['action']){ // run the delete code..
This way if you do accidentally use = instead of == you will get a PHP error.
It’s a hard practice to get into, but well worth it in the long run.
Destructive actions should not be mapped onto GET requests, so instead of using $_REQUEST, one should always stick to using $_POST.